How determine most recent active local windows user accounts?

Question

We have a few computers that many employees (70+) have used over the years. I am upgrading these and want to transfer the most recent users. Just the ones that have signed into the system in the last 3 months.

Looking at the users folder and using modified dates is inaccurate, some are off by a year even if a user signed in yesterday.

AD only tells me the last user.

How can I determine the most recent signed in users?

Answer 1

If you have it enabled: on event viewer in the security protocoll, keyword Audit Success, category logon, ID 4624...

You can enable it using Local Group Policy Editor -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Audit Policy. You need to enable "Audit logon events".

I like a batch readout via powershell that can show me a table, like this one.

Alternatively you could use a cmd script that starts up on each login:

::Optional
@echo off

::Checks for folder and creats it if it doesnt exist
if not exist c:\Logs md c:\Logs

::checks the userinfo and writes it into the log file including time stamp
echo Logon: %date% %time:~0,5% %UserName% >> c:\Logs\History.txt

Or you could use a third party tool, e.g. this one